For the purposes of ISO adherence – across all information security and privacy protection standards – nonconformity can broadly be defined as any failure to meet a clause-specific standard.
Nonconformities can occur within internal or external guidance points, either towards an organisation’s own set of policies and procedures, or as applicable towards their regulatory and/or legal requirements as a PII processor.
ISO 27701 Clause 5.8 deals with an organisation’s ability to detect, manage, resolve and evaluate nonconformities within the scope of a PIMS, and its broader privacy protection policy.
The guidance revolves around two key stages – dealing with nonconformities at point of discovery, and what should happen in order to prevent them from recurring.
Both of ISO 27701 5.8’s sub-clauses contain information provided within ISO 27001, but in the case of ISO 27701, are instead applicable to nonconformities within privacy protection and PIMS management.
ISO 27701 5.8 doesn’t contain any additional guidance for PIMS-related activities, other than what is provided in the context of ISO 27001, and doesn’t hold any relevance within GDPR.
When the organisation discovers a nonconformity, they should:
ISO stipulates that any corrective action taken should be proportionate to the risks caused by the nonconformity itself.
Documented evidence should be retained to evidence:
Book a tailored hands-on session
based on your needs and goals
Book your demo
Organisations should ask themselves three questions when seeking to improve their PIMS, and by proxy, their privacy protection policy:
| ISO 27701 Clause Identifier | ISO 27701 Clause Name | ISO 27001 Requirement | Associated GDPR Articles |
|---|---|---|---|
| 5.8.1 | Nonconformity and Corrective Action | 10.1 – Nonconformity and Corrective Action for ISO 27001 | None |
| 5.8.2 | Continual Improvement | 10.2 – Continual Improvement for ISO 27001 | None |
By adding a PIMS to your ISMS on the ISMS.online platform, your security posture remains all-in-one-place and you’ll avoid duplication where the standards overlap.
With your PIMS instantly accessible to interested parties, it’s never been easier to monitor, report and audit against both ISO 27001 and ISO 27701 at the click of a button.
Find out how much time and money you’ll save on your journey to a combined ISO 27001 and 27701 certification using ISMS.online by booking a demo.
Book a tailored hands-on session
based on your needs and goals
Book your demo
We can’t think of any company whose service can hold a candle to ISMS.online.
